1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, split Nov 2006
3 // Modified by Greg Jones, Jan 2009
4 // Modified by Adrian Dabrowski "atrox", Mar-Sept 2010,Oct 2011
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
9 //-----------------------------------------------------------------------------
10 // Routines to support ISO 15693. This includes both the reader software and
11 // the `fake tag' modes, but at the moment I've implemented only the reader
12 // stuff, and that barely.
13 // Modified to perform modulation onboard in arm rather than on PC
14 // Also added additional reader commands (SELECT, READ etc.)
15 //-----------------------------------------------------------------------------
16 // The ISO 15693 describes two transmission modes from reader to tag, and 4
17 // transmission modes from tag to reader. As of Mar 2010 this code only
18 // supports one of each: "1of4" mode from reader to tag, and the highspeed
19 // variant with one subcarrier from card to reader.
20 // As long, as the card fully support ISO 15693 this is no problem, since the
21 // reader chooses both data rates, but some non-standard tags do not. Further for
22 // the simulation to work, we will need to support all data rates.
24 // VCD (reader) -> VICC (tag)
26 // data rate: 1,66 kbit/s (fc/8192)
27 // used for long range
29 // data rate: 26,48 kbit/s (fc/512)
30 // used for short range, high speed
32 // VICC (tag) -> VCD (reader)
34 // ASK / one subcarrier (423,75 khz)
35 // FSK / two subcarriers (423,75 khz && 484,28 khz)
36 // Data Rates / Modes:
37 // low ASK: 6,62 kbit/s
38 // low FSK: 6.67 kbit/s
39 // high ASK: 26,48 kbit/s
40 // high FSK: 26,69 kbit/s
41 //-----------------------------------------------------------------------------
42 // added "1 out of 256" mode (for VCD->PICC) - atrox 20100911
46 // *) UID is always used "transmission order" (LSB), which is reverse to display order
48 // TODO / BUGS / ISSUES:
49 // *) writing to tags takes longer: we miss the answer from the tag in most cases
50 // -> tweak the read-timeout times
51 // *) signal decoding from the card is still a bit shaky.
52 // *) signal decoding is unable to detect collissions.
53 // *) add anti-collission support for inventory-commands
54 // *) read security status of a block
55 // *) sniffing and simulation do only support one transmission mode. need to support
56 // all 8 transmission combinations
57 // *) remove or refactor code under "depricated"
58 // *) document all the functions
61 #include "proxmark3.h"
65 #include "iso15693tools.h"
68 #define arraylen(x) (sizeof(x)/sizeof((x)[0]))
70 ///////////////////////////////////////////////////////////////////////
71 // ISO 15693 Part 2 - Air Interface
72 // This section basicly contains transmission and receiving of bits
73 ///////////////////////////////////////////////////////////////////////
75 #define FrameSOF Iso15693FrameSOF
76 #define Logic0 Iso15693Logic0
77 #define Logic1 Iso15693Logic1
78 #define FrameEOF Iso15693FrameEOF
80 #define Crc(data,datalen) Iso15693Crc(data,datalen)
81 #define AddCrc(data,datalen) Iso15693AddCrc(data,datalen)
82 #define sprintUID(target,uid) Iso15693sprintUID(target,uid)
87 // ---------------------------
89 // ---------------------------
91 // prepare data using "1 out of 4" code for later transmission
92 // resulting data rate is 26,48 kbit/s (fc/512)
94 // n ... length of data
95 static void CodeIso15693AsReader(uint8_t *cmd
, int n
)
101 // Give it a bit of slack at the beginning
102 for(i
= 0; i
< 24; i
++) {
115 for(i
= 0; i
< n
; i
++) {
116 for(j
= 0; j
< 8; j
+= 2) {
117 int these
= (cmd
[i
] >> j
) & 3;
168 // And slack at the end, too.
169 for(i
= 0; i
< 24; i
++) {
174 // encode data using "1 out of 256" sheme
175 // data rate is 1,66 kbit/s (fc/8192)
176 // is designed for more robust communication over longer distances
177 static void CodeIso15693AsReader256(uint8_t *cmd
, int n
)
183 // Give it a bit of slack at the beginning
184 for(i
= 0; i
< 24; i
++) {
198 for(i
= 0; i
< n
; i
++) {
199 for (j
= 0; j
<=255; j
++) {
215 // And slack at the end, too.
216 for(i
= 0; i
< 24; i
++) {
222 // Transmit the command (to the tag) that was placed in ToSend[].
223 static void TransmitTo15693Tag(const uint8_t *cmd
, int len
, int *samples
, int *wait
)
227 // FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
228 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX
);
229 if(*wait
< 10) { *wait
= 10; }
231 // for(c = 0; c < *wait;) {
232 // if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
233 // AT91C_BASE_SSC->SSC_THR = 0x00; // For exact timing!
236 // if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
237 // volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
245 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
246 AT91C_BASE_SSC
->SSC_THR
= cmd
[c
];
252 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
253 volatile uint32_t r
= AT91C_BASE_SSC
->SSC_RHR
;
258 *samples
= (c
+ *wait
) << 3;
261 //-----------------------------------------------------------------------------
262 // Transmit the command (to the reader) that was placed in ToSend[].
263 //-----------------------------------------------------------------------------
264 static void TransmitTo15693Reader(const uint8_t *cmd
, int len
, int *samples
, int *wait
)
267 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR
|FPGA_HF_SIMULATOR_MODULATE_424K
);
268 if(*wait
< 10) { *wait
= 10; }
271 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
272 AT91C_BASE_SSC
->SSC_THR
= cmd
[c
];
278 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
279 volatile uint32_t r
= AT91C_BASE_SSC
->SSC_RHR
;
284 *samples
= (c
+ *wait
) << 3;
295 // number of decoded bytes
296 static int GetIso15693AnswerFromTag(uint8_t *receivedResponse
, int maxLen
, int *samples
, int *elapsed
)
299 uint8_t *dest
= (uint8_t *)BigBuf
;
305 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
);
306 //spindelay(60); // greg - experiment to get rid of some of the 0 byte/failed reads
310 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
311 AT91C_BASE_SSC
->SSC_THR
= 0x43;
313 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
315 b
= (int8_t)AT91C_BASE_SSC
->SSC_RHR
;
317 // The samples are correlations against I and Q versions of the
318 // tone that the tag AM-modulates, so every other sample is I,
319 // every other is Q. We just want power, so abs(I) + abs(Q) is
320 // close to what we want.
335 dest
[c
++] = (uint8_t)r
;
348 //////////////////////////////////////////
349 /////////// DEMODULATE ///////////////////
350 //////////////////////////////////////////
353 int max
= 0, maxPos
=0;
357 // if(GraphTraceLen < 1000) return; // THIS CHECKS FOR A BUFFER TO SMALL
359 // First, correlate for SOF
360 for(i
= 0; i
< 100; i
++) {
362 for(j
= 0; j
< arraylen(FrameSOF
); j
+= skip
) {
363 corr
+= FrameSOF
[j
]*dest
[i
+(j
/skip
)];
370 // DbpString("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));
372 int k
= 0; // this will be our return value
374 // greg - If correlation is less than 1 then there's little point in continuing
375 if ((max
/(arraylen(FrameSOF
)/skip
)) >= 1)
378 i
= maxPos
+ arraylen(FrameSOF
)/skip
;
381 memset(outBuf
, 0, sizeof(outBuf
));
384 int corr0
= 0, corr1
= 0, corrEOF
= 0;
385 for(j
= 0; j
< arraylen(Logic0
); j
+= skip
) {
386 corr0
+= Logic0
[j
]*dest
[i
+(j
/skip
)];
388 for(j
= 0; j
< arraylen(Logic1
); j
+= skip
) {
389 corr1
+= Logic1
[j
]*dest
[i
+(j
/skip
)];
391 for(j
= 0; j
< arraylen(FrameEOF
); j
+= skip
) {
392 corrEOF
+= FrameEOF
[j
]*dest
[i
+(j
/skip
)];
394 // Even things out by the length of the target waveform.
398 if(corrEOF
> corr1
&& corrEOF
> corr0
) {
399 // DbpString("EOF at %d", i);
401 } else if(corr1
> corr0
) {
402 i
+= arraylen(Logic1
)/skip
;
405 i
+= arraylen(Logic0
)/skip
;
412 if((i
+(int)arraylen(FrameEOF
)) >= 2000) {
413 DbpString("ran off end!");
417 if(mask
!= 0x01) { // this happens, when we miss the EOF
418 // TODO: for some reason this happens quite often
419 if (DEBUG
) Dbprintf("error, uneven octet! (extra bits!) mask=%02x", mask
);
420 if (mask
<0x08) k
--; // discard the last uneven octet;
421 // 0x08 is an assumption - but works quite often
425 // strncat(str1," octets read",8);
427 // DbpString( str1); // DbpString("%d octets", k);
429 // for(i = 0; i < k; i+=3) {
430 // //DbpString("# %2d: %02x ", i, outBuf[i]);
431 // DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]);
434 for(i
= 0; i
< k
; i
++) {
435 receivedResponse
[i
] = outBuf
[i
];
437 } // "end if correlation > 0" (max/(arraylen(FrameSOF)/skip))
438 return k
; // return the number of bytes demodulated
440 /// DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
445 // Now the GetISO15693 message from sniffing command
446 static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse
, int maxLen
, int *samples
, int *elapsed
)
449 uint8_t *dest
= (uint8_t *)BigBuf
;
455 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
);
456 //spindelay(60); // greg - experiment to get rid of some of the 0 byte/failed reads
460 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
461 AT91C_BASE_SSC
->SSC_THR
= 0x43;
463 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
464 int8_t b
= (int8_t)AT91C_BASE_SSC
->SSC_RHR
;
466 // The samples are correlations against I and Q versions of the
467 // tone that the tag AM-modulates, so every other sample is I,
468 // every other is Q. We just want power, so abs(I) + abs(Q) is
469 // close to what we want.
484 dest
[c
++] = (uint8_t)r
;
497 //////////////////////////////////////////
498 /////////// DEMODULATE ///////////////////
499 //////////////////////////////////////////
502 int max
= 0, maxPos
=0;
506 // if(GraphTraceLen < 1000) return; // THIS CHECKS FOR A BUFFER TO SMALL
508 // First, correlate for SOF
509 for(i
= 0; i
< 19000; i
++) {
511 for(j
= 0; j
< arraylen(FrameSOF
); j
+= skip
) {
512 corr
+= FrameSOF
[j
]*dest
[i
+(j
/skip
)];
519 // DbpString("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));
521 int k
= 0; // this will be our return value
523 // greg - If correlation is less than 1 then there's little point in continuing
524 if ((max
/(arraylen(FrameSOF
)/skip
)) >= 1) // THIS SHOULD BE 1
527 i
= maxPos
+ arraylen(FrameSOF
)/skip
;
530 memset(outBuf
, 0, sizeof(outBuf
));
533 int corr0
= 0, corr1
= 0, corrEOF
= 0;
534 for(j
= 0; j
< arraylen(Logic0
); j
+= skip
) {
535 corr0
+= Logic0
[j
]*dest
[i
+(j
/skip
)];
537 for(j
= 0; j
< arraylen(Logic1
); j
+= skip
) {
538 corr1
+= Logic1
[j
]*dest
[i
+(j
/skip
)];
540 for(j
= 0; j
< arraylen(FrameEOF
); j
+= skip
) {
541 corrEOF
+= FrameEOF
[j
]*dest
[i
+(j
/skip
)];
543 // Even things out by the length of the target waveform.
547 if(corrEOF
> corr1
&& corrEOF
> corr0
) {
548 // DbpString("EOF at %d", i);
550 } else if(corr1
> corr0
) {
551 i
+= arraylen(Logic1
)/skip
;
554 i
+= arraylen(Logic0
)/skip
;
561 if((i
+(int)arraylen(FrameEOF
)) >= 2000) {
562 DbpString("ran off end!");
567 DbpString("sniff: error, uneven octet! (discard extra bits!)");
568 /// DbpString(" mask=%02x", mask);
572 // strncat(str1," octets read",8);
574 // DbpString( str1); // DbpString("%d octets", k);
576 // for(i = 0; i < k; i+=3) {
577 // //DbpString("# %2d: %02x ", i, outBuf[i]);
578 // DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]);
581 for(i
= 0; i
< k
; i
++) {
582 receivedResponse
[i
] = outBuf
[i
];
584 } // "end if correlation > 0" (max/(arraylen(FrameSOF)/skip))
585 return k
; // return the number of bytes demodulated
587 /// DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
591 static void BuildIdentifyRequest(void);
592 //-----------------------------------------------------------------------------
593 // Start to read an ISO 15693 tag. We send an identify request, then wait
594 // for the response. The response is not demodulated, just left in the buffer
595 // so that it can be downloaded to a PC and processed there.
596 //-----------------------------------------------------------------------------
597 void AcquireRawAdcSamplesIso15693(void)
599 uint8_t *dest
= (uint8_t *)BigBuf
;
605 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
606 BuildIdentifyRequest();
608 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
610 // Give the tags time to energize
611 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
);
614 // Now send the command
616 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX
);
620 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
621 AT91C_BASE_SSC
->SSC_THR
= ToSend
[c
];
623 if(c
== ToSendMax
+3) {
627 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
628 volatile uint32_t r
= AT91C_BASE_SSC
->SSC_RHR
;
634 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
);
639 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
640 AT91C_BASE_SSC
->SSC_THR
= 0x43;
642 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
644 b
= (int8_t)AT91C_BASE_SSC
->SSC_RHR
;
646 // The samples are correlations against I and Q versions of the
647 // tone that the tag AM-modulates, so every other sample is I,
648 // every other is Q. We just want power, so abs(I) + abs(Q) is
649 // close to what we want.
664 dest
[c
++] = (uint8_t)r
;
679 void RecordRawAdcSamplesIso15693(void)
681 uint8_t *dest
= (uint8_t *)BigBuf
;
687 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
691 // Start from off (no field generated)
692 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
695 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
699 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
);
704 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
705 AT91C_BASE_SSC
->SSC_THR
= 0x43;
707 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
709 b
= (int8_t)AT91C_BASE_SSC
->SSC_RHR
;
711 // The samples are correlations against I and Q versions of the
712 // tone that the tag AM-modulates, so every other sample is I,
713 // every other is Q. We just want power, so abs(I) + abs(Q) is
714 // close to what we want.
729 dest
[c
++] = (uint8_t)r
;
742 Dbprintf("fin record");
746 // Initialize the proxmark as iso15k reader
747 // (this might produces glitches that confuse some tags
748 void Iso15693InitReader() {
754 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
758 // Start from off (no field generated)
759 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
762 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
765 // Give the tags time to energize
766 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
);
775 ///////////////////////////////////////////////////////////////////////
776 // ISO 15693 Part 3 - Air Interface
777 // This section basicly contains transmission and receiving of bits
778 ///////////////////////////////////////////////////////////////////////
780 // Encode (into the ToSend buffers) an identify request, which is the first
781 // thing that you must send to a tag to get a response.
782 static void BuildIdentifyRequest(void)
787 // one sub-carrier, inventory, 1 slot, fast rate
788 // AFI is at bit 5 (1<<4) when doing an INVENTORY
789 cmd
[0] = (1 << 2) | (1 << 5) | (1 << 1);
790 // inventory command code
799 CodeIso15693AsReader(cmd
, sizeof(cmd
));
802 // uid is in transmission order (which is reverse of display order)
803 static void BuildReadBlockRequest(uint8_t *uid
, uint8_t blockNumber
)
808 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
809 // followed by teh block data
810 // one sub-carrier, inventory, 1 slot, fast rate
811 cmd
[0] = (1 << 6)| (1 << 5) | (1 << 1); // no SELECT bit, ADDR bit, OPTION bit
812 // READ BLOCK command code
814 // UID may be optionally specified here
823 cmd
[9] = uid
[7]; // 0xe0; // always e0 (not exactly unique)
824 // Block number to read
825 cmd
[10] = blockNumber
;//0x00;
827 crc
= Crc(cmd
, 11); // the crc needs to be calculated over 12 bytes
828 cmd
[11] = crc
& 0xff;
831 CodeIso15693AsReader(cmd
, sizeof(cmd
));
834 // Now the VICC>VCD responses when we are simulating a tag
835 static void BuildInventoryResponse( uint8_t *uid
)
840 // one sub-carrier, inventory, 1 slot, fast rate
841 // AFI is at bit 5 (1<<4) when doing an INVENTORY
842 //(1 << 2) | (1 << 5) | (1 << 1);
844 cmd
[1] = 0; // DSFID (data storage format identifier). 0x00 = not supported
846 cmd
[2] = uid
[7]; //0x32;
847 cmd
[3] = uid
[6]; //0x4b;
848 cmd
[4] = uid
[5]; //0x03;
849 cmd
[5] = uid
[4]; //0x01;
850 cmd
[6] = uid
[3]; //0x00;
851 cmd
[7] = uid
[2]; //0x10;
852 cmd
[8] = uid
[1]; //0x05;
853 cmd
[9] = uid
[0]; //0xe0;
856 cmd
[10] = crc
& 0xff;
859 CodeIso15693AsReader(cmd
, sizeof(cmd
));
862 // Universal Method for sending to and recv bytes from a tag
863 // init ... should we initialize the reader?
864 // speed ... 0 low speed, 1 hi speed
865 // **recv will return you a pointer to the received data
866 // If you do not need the answer use NULL for *recv[]
867 // return: lenght of received data
868 int SendDataTag(uint8_t *send
, int sendlen
, int init
, int speed
, uint8_t **recv
) {
881 uint8_t *answer
= (((uint8_t *)BigBuf
) + 3660);
882 if (recv
!=NULL
) memset(BigBuf
+ 3660, 0, 100);
884 if (init
) Iso15693InitReader();
887 // low speed (1 out of 256)
888 CodeIso15693AsReader256(send
, sendlen
);
890 // high speed (1 out of 4)
891 CodeIso15693AsReader(send
, sendlen
);
897 TransmitTo15693Tag(ToSend
,ToSendMax
,&tsamples
, &wait
);
898 // Now wait for a response
902 answerLen
= GetIso15693AnswerFromTag(answer
, 100, &samples
, &elapsed
) ;
915 // --------------------------------------------------------------------
917 // --------------------------------------------------------------------
919 // Decodes a message from a tag and displays its metadata and content
920 #define DBD15STATLEN 48
921 void DbdecodeIso15693Answer(int len
, uint8_t *d
) {
922 char status
[DBD15STATLEN
+1]={0};
927 strncat(status
,"ProtExt ",DBD15STATLEN
);
930 strncat(status
,"Error ",DBD15STATLEN
);
933 strncat(status
,"01:notSupp",DBD15STATLEN
);
936 strncat(status
,"02:notRecog",DBD15STATLEN
);
939 strncat(status
,"03:optNotSupp",DBD15STATLEN
);
942 strncat(status
,"0f:noInfo",DBD15STATLEN
);
945 strncat(status
,"10:dontExist",DBD15STATLEN
);
948 strncat(status
,"11:lockAgain",DBD15STATLEN
);
951 strncat(status
,"12:locked",DBD15STATLEN
);
954 strncat(status
,"13:progErr",DBD15STATLEN
);
957 strncat(status
,"14:lockErr",DBD15STATLEN
);
960 strncat(status
,"unknownErr",DBD15STATLEN
);
962 strncat(status
," ",DBD15STATLEN
);
964 strncat(status
,"NoErr ",DBD15STATLEN
);
968 if ( (( crc
& 0xff ) == d
[len
-2]) && (( crc
>> 8 ) == d
[len
-1]) )
969 strncat(status
,"CrcOK",DBD15STATLEN
);
971 strncat(status
,"CrcFail!",DBD15STATLEN
);
973 Dbprintf("%s",status
);
979 ///////////////////////////////////////////////////////////////////////
980 // Functions called via USB/Client
981 ///////////////////////////////////////////////////////////////////////
983 void SetDebugIso15693(uint32_t debug
) {
985 Dbprintf("Iso15693 Debug is now %s",DEBUG
?"on":"off");
991 //-----------------------------------------------------------------------------
992 // Simulate an ISO15693 reader, perform anti-collision and then attempt to read a sector
993 // all demodulation performed in arm rather than host. - greg
994 //-----------------------------------------------------------------------------
995 void ReaderIso15693(uint32_t parameter
)
1002 uint8_t *answer1
= (((uint8_t *)BigBuf
) + 3660); //
1003 uint8_t *answer2
= (((uint8_t *)BigBuf
) + 3760);
1004 uint8_t *answer3
= (((uint8_t *)BigBuf
) + 3860);
1014 uint8_t TagUID
[8] = {0x00};
1018 memset(BigBuf
+ 3660, 0x00, 300);
1020 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
1022 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
1026 // Start from off (no field generated)
1027 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1030 // Give the tags time to energize
1031 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
);
1039 // FIRST WE RUN AN INVENTORY TO GET THE TAG UID
1040 // THIS MEANS WE CAN PRE-BUILD REQUESTS TO SAVE CPU TIME
1042 // Now send the IDENTIFY command
1043 BuildIdentifyRequest();
1045 TransmitTo15693Tag(ToSend
,ToSendMax
,&tsamples
, &wait
);
1047 // Now wait for a response
1048 answerLen1
= GetIso15693AnswerFromTag(answer1
, 100, &samples
, &elapsed
) ;
1050 if (answerLen1
>=12) // we should do a better check than this
1052 TagUID
[0] = answer1
[2];
1053 TagUID
[1] = answer1
[3];
1054 TagUID
[2] = answer1
[4];
1055 TagUID
[3] = answer1
[5];
1056 TagUID
[4] = answer1
[6];
1057 TagUID
[5] = answer1
[7];
1058 TagUID
[6] = answer1
[8]; // IC Manufacturer code
1059 TagUID
[7] = answer1
[9]; // always E0
1063 Dbprintf("%d octets read from IDENTIFY request:", answerLen1
);
1064 DbdecodeIso15693Answer(answerLen1
,answer1
);
1065 Dbhexdump(answerLen1
,answer1
,true);
1069 Dbprintf("UID = %02hX%02hX%02hX%02hX%02hX%02hX%02hX%02hX",
1070 TagUID
[7],TagUID
[6],TagUID
[5],TagUID
[4],
1071 TagUID
[3],TagUID
[2],TagUID
[1],TagUID
[0]);
1074 Dbprintf("%d octets read from SELECT request:", answerLen2
);
1075 DbdecodeIso15693Answer(answerLen2
,answer2
);
1076 Dbhexdump(answerLen2
,answer2
,true);
1078 Dbprintf("%d octets read from XXX request:", answerLen3
);
1079 DbdecodeIso15693Answer(answerLen3
,answer3
);
1080 Dbhexdump(answerLen3
,answer3
,true);
1083 if (answerLen1
>=12 && DEBUG
) {
1085 while (i
<32) { // sanity check, assume max 32 pages
1086 BuildReadBlockRequest(TagUID
,i
);
1087 TransmitTo15693Tag(ToSend
,ToSendMax
,&tsamples
, &wait
);
1088 answerLen2
= GetIso15693AnswerFromTag(answer2
, 100, &samples
, &elapsed
);
1090 Dbprintf("READ SINGLE BLOCK %d returned %d octets:",i
,answerLen2
);
1091 DbdecodeIso15693Answer(answerLen2
,answer2
);
1092 Dbhexdump(answerLen2
,answer2
,true);
1093 if ( *((uint32_t*) answer2
) == 0x07160101 ) break; // exit on NoPageErr
1105 // Simulate an ISO15693 TAG, perform anti-collision and then print any reader commands
1106 // all demodulation performed in arm rather than host. - greg
1107 void SimTagIso15693(uint32_t parameter
, uint8_t *uid
)
1114 uint8_t *buf
= (((uint8_t *)BigBuf
) + 3660); //
1122 memset(buf
, 0x00, 100);
1124 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
1126 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
1130 // Start from off (no field generated)
1131 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1140 answerLen1
= GetIso15693AnswerFromSniff(buf
, 100, &samples
, &elapsed
) ;
1142 if (answerLen1
>=1) // we should do a better check than this
1144 // Build a suitable reponse to the reader INVENTORY cocmmand
1145 // not so obsvious, but in the call to BuildInventoryResponse, the command is copied to the global ToSend buffer used below.
1147 BuildInventoryResponse(uid
);
1149 TransmitTo15693Reader(ToSend
,ToSendMax
, &tsamples
, &wait
);
1152 Dbprintf("%d octets read from reader command: %x %x %x %x %x %x %x %x %x", answerLen1
,
1153 buf
[0], buf
[1], buf
[2], buf
[3],
1154 buf
[4], buf
[5], buf
[6], buf
[7], buf
[8]);
1156 Dbprintf("Simulationg uid: %x %x %x %x %x %x %x %x",
1157 uid
[0], uid
[1], uid
[2], uid
[3],
1158 uid
[4], uid
[5], uid
[6], uid
[7]);
1167 // Since there is no standardized way of reading the AFI out of a tag, we will brute force it
1168 // (some manufactures offer a way to read the AFI, though)
1169 void BruteforceIso15693Afi(uint32_t speed
)
1173 int datalen
=0, recvlen
=0;
1175 Iso15693InitReader();
1177 // first without AFI
1178 // Tags should respond wihtout AFI and with AFI=0 even when AFI is active
1180 data
[0]=ISO15_REQ_SUBCARRIER_SINGLE
| ISO15_REQ_DATARATE_HIGH
|
1181 ISO15_REQ_INVENTORY
| ISO15_REQINV_SLOT1
;
1182 data
[1]=ISO15_CMD_INVENTORY
;
1183 data
[2]=0; // mask length
1184 datalen
=AddCrc(data
,3);
1185 recvlen
=SendDataTag(data
,datalen
,0,speed
,&recv
);
1188 Dbprintf("NoAFI UID=%s",sprintUID(NULL
,&recv
[2]));
1193 data
[0]=ISO15_REQ_SUBCARRIER_SINGLE
| ISO15_REQ_DATARATE_HIGH
|
1194 ISO15_REQ_INVENTORY
| ISO15_REQINV_AFI
| ISO15_REQINV_SLOT1
;
1195 data
[1]=ISO15_CMD_INVENTORY
;
1197 data
[3]=0; // mask length
1199 for (int i
=0;i
<256;i
++) {
1201 datalen
=AddCrc(data
,4);
1202 recvlen
=SendDataTag(data
,datalen
,0,speed
,&recv
);
1205 Dbprintf("AFI=%i UID=%s",i
,sprintUID(NULL
,&recv
[2]));
1208 Dbprintf("AFI Bruteforcing done.");
1212 // Allows to directly send commands to the tag via the client
1213 void DirectTag15693Command(uint32_t datalen
,uint32_t speed
, uint32_t recv
, uint8_t data
[]) {
1216 uint8_t *recvbuf
=(uint8_t *)BigBuf
;
1221 Dbhexdump(datalen
,data
,true);
1224 recvlen
=SendDataTag(data
,datalen
,1,speed
,(recv
?&recvbuf
:NULL
));
1228 cmd_send(CMD_ACK
,recvlen
>48?48:recvlen
,0,0,recvbuf
,48);
1233 DbdecodeIso15693Answer(recvlen
,recvbuf
);
1234 Dbhexdump(recvlen
,recvbuf
,true);
1243 // --------------------------------------------------------------------
1244 // -- Misc & deprecated functions
1245 // --------------------------------------------------------------------
1249 // do not use; has a fix UID
1250 static void __attribute__((unused)) BuildSysInfoRequest(uint8_t *uid)
1255 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1256 // followed by teh block data
1257 // one sub-carrier, inventory, 1 slot, fast rate
1258 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1259 // System Information command code
1261 // UID may be optionally specified here
1270 cmd[9]= 0xe0; // always e0 (not exactly unique)
1272 crc = Crc(cmd, 10); // the crc needs to be calculated over 2 bytes
1273 cmd[10] = crc & 0xff;
1276 CodeIso15693AsReader(cmd, sizeof(cmd));
1280 // do not use; has a fix UID
1281 static void __attribute__((unused)) BuildReadMultiBlockRequest(uint8_t *uid)
1286 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1287 // followed by teh block data
1288 // one sub-carrier, inventory, 1 slot, fast rate
1289 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1290 // READ Multi BLOCK command code
1292 // UID may be optionally specified here
1301 cmd[9]= 0xe0; // always e0 (not exactly unique)
1302 // First Block number to read
1304 // Number of Blocks to read
1305 cmd[11] = 0x2f; // read quite a few
1307 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1308 cmd[12] = crc & 0xff;
1311 CodeIso15693AsReader(cmd, sizeof(cmd));
1314 // do not use; has a fix UID
1315 static void __attribute__((unused)) BuildArbitraryRequest(uint8_t *uid,uint8_t CmdCode)
1320 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1321 // followed by teh block data
1322 // one sub-carrier, inventory, 1 slot, fast rate
1323 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1324 // READ BLOCK command code
1326 // UID may be optionally specified here
1335 cmd[9]= 0xe0; // always e0 (not exactly unique)
1341 // cmd[13] = 0x00; //Now the CRC
1342 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1343 cmd[12] = crc & 0xff;
1346 CodeIso15693AsReader(cmd, sizeof(cmd));
1349 // do not use; has a fix UID
1350 static void __attribute__((unused)) BuildArbitraryCustomRequest(uint8_t uid[], uint8_t CmdCode)
1355 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1356 // followed by teh block data
1357 // one sub-carrier, inventory, 1 slot, fast rate
1358 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1359 // READ BLOCK command code
1361 // UID may be optionally specified here
1370 cmd[9]= 0xe0; // always e0 (not exactly unique)
1372 cmd[10] = 0x05; // for custom codes this must be manufcturer code
1376 // cmd[13] = 0x00; //Now the CRC
1377 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1378 cmd[12] = crc & 0xff;
1381 CodeIso15693AsReader(cmd, sizeof(cmd));